Best Free OSINT Tools in 2026 (Ranked by What They Actually Find)

Free Tools Get You 60% There — Here's How to Cover the Rest Without Spending Much

The OSINT community has built an impressive set of free tools over the past decade. Many were developed by security researchers, academics, and intelligence practitioners who needed something and built it themselves. Several are genuinely excellent and used daily by professional investigators.

The limitation is almost always the same: free tools are great at discovery and mapping, but weak at contact data extraction. Finding that someone exists on six platforms is different from finding their direct phone number. The first task is largely covered by free tools. The second requires access to commercial data aggregators that compile public records — and that access costs money.

This guide ranks the genuinely useful free tools by category and is honest about where the gaps are.

Category 1: Identity and Social Profile Discovery

Sherlock (GitHub, free). The most reliable username-to-platform mapper available. Give Sherlock a username and it checks 300+ platforms for accounts using that username. Invaluable for building a subject's social footprint quickly. Runs locally via Python.

WhatsMyName (osintframework.com, free). Similar to Sherlock but browser-based. Slightly different platform list. Useful as a cross-check when Sherlock misses something or returns ambiguous results.

Namechk (namechk.com, free). Good for checking username availability across social platforms — useful in reverse, since a "taken" username suggests an account exists there.

IntelTechniques (inteltechniques.com, free tools section). Michael Bazzell's OSINT framework includes dozens of search templates for Facebook, Twitter, LinkedIn, and other platforms. Not automated, but the structured search queries are genuinely useful for manual investigation.

Category 2: Email Discovery and Verification

Hunter.io (free tier: 25 searches/month). The most reliable tool for finding business email addresses associated with a domain. Enter a company domain and get a list of known email addresses and the domain's email format pattern. The free tier is enough for occasional use; serious users hit the cap quickly.

TheHarvester (free, open source). A command-line tool that searches Google, Bing, LinkedIn, and other sources for email addresses and subdomains associated with a target. Great for initial recon. Results vary significantly by target domain and what's been indexed publicly.

Verify-Email.org (free). Basic SMTP email verification. Checks if the email address can receive mail without actually sending. Not as reliable as paid verifiers but useful for quick spot-checking before outreach.

The gap: none of these tools find personal emails or phone numbers from social profiles. For that layer — which is often the most operationally valuable — you need a tool connected to a commercial data aggregator. Ziwa's enrichment handles this via People Data Labs, which aggregates contact data from thousands of public sources into a single lookup.

Category 3: Network and Domain Intelligence

Shodan (free tier). The search engine for internet-connected devices. Useful for corporate intelligence — what's exposed on a company's network, what services are running, what vulnerabilities are visible. Free tier is limited to basic searches; Shodan's paid tier unlocks filters and data export.

VirusTotal (free). Analyzes files, URLs, domains, and IPs against dozens of security databases simultaneously. Useful for investigating suspicious domains or verifying that an entity is legitimate before engaging.

ViewDNS.info (free). DNS history, IP lookup, reverse IP lookup, and WHOIS data in one place. Excellent for mapping corporate infrastructure or verifying domain ownership and registration history.

SecurityTrails (free tier). Historical DNS records and subdomain enumeration. Useful for understanding when a domain was registered and what infrastructure it has used over time — helpful for verifying a company's authenticity.

Category 4: Image and Identity Verification

Google Reverse Image Search (free). Still the most widely used tool for finding where an image appears online. Useful for verifying profile photos are genuine or finding other accounts using the same image — a classic fake profile indicator.

TinEye (free). Image search focused on exact and near-duplicate matches. Often finds results Google misses, especially for older or slightly modified images that have been cropped or recolored.

PimEyes (freemium). Facial recognition search engine. The free tier shows whether matches exist; viewing them requires a paid plan. Controversial but genuinely powerful for identity verification when a profile photo is in question.

EXIF data tools (multiple free options). Extract metadata from images including GPS coordinates, camera model, and timestamp. Jeffrey's Exif Viewer and ExifTool are the most commonly used for this purpose.

Where Free Tools Hit a Wall

The honest summary: free OSINT tools are excellent at mapping the surface of a subject's digital footprint. They tell you where someone exists and what they've shared publicly. They are not good at finding contact information that a person hasn't explicitly listed in a public profile.

That last 40% — the actual phone number, the email address used for business, the mobile number from a public record that was indexed years ago and hasn't been updated — requires access to commercial data aggregators. People Data Labs, Clearbit, Pipl, and similar companies compile contact records from thousands of public sources. Their APIs are not free.

Tools like Ziwa provide access to these aggregators with a pay-per-result model — no subscription, no monthly fee, just credits charged when actual data is found. For most free-tool users who occasionally need to get a phone number or email for a specific target, this approach is far more economical than committing to a full data subscription.

Start with free tools for discovery. When you need contact data, check Ziwa's pricing and top up credits as needed. That hybrid approach covers the full investigation workflow at a fraction of the cost of any all-in-one commercial suite.